Most organizations set Active Directory Account Lockout Policy to a maximum number of three to five logon attempts. Once the threshold has been exceeded, users either need to call the helpdesk to have their account unlocked, or wait 30 minutes for the account to be unlocked automatically. While it's a necessary best practice to defend against brute force password attacks on Active Directory, account lockout policy sometimes leads users to accidentally lock themselves out, generating extra work for the help desk.
↧